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IN THE CLAIMS ; 

Please amend claims 1, 5, and 21 as indicated below. 
A listing of the status of all claims 1-24 in the present 
patent application is provided below. 

1 (Currently Amended) . A method for tracing source addresses of 
packets, the method comprising: 

receiving a current packet at a first n etwork element; 
identifying at least part of a source address of the 
current packet ; 

querying a storage module of the first network element to 
identify at least one source address of a previously received 
packet ; 

determining whether the at least part of the source address 
of the current packet matches at least part of the at least one 
source address of the previously received packet; and 

routing the current packet to a second n etwork element if 
the at least part of the source address of the current packet 
matches at least part of the at least one source address of the 
previously received packet. 

2 (Previously Presented) . The method according to claim 1, 
where the at least one source address of the previously received 
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packet is recorded in a hierarchical data structure, wherein the 

hierarchical data structure is based at least in part on a 

plurality of classes of subnet. 

3 (Previously Presented) . The method according to claim 1, 
where a Last Time Seen (LTS) value associated with each of the 
at least one source address of the previously received packet is 
recorded. 

4 (Previously Presented) . The method according to claim 1, 
further comprising: 

recording an arrival time of the packet. 

5 (Currently Amended) . The method according to claim 1, further 
comprising : 

routing the current packet to the second network element 
with a warning if the at least part of the source address of the 
current packet does not match at least part of the at least one 
source address of the previously received packet; and 

recording the at least part of the source address of the 
current packet and reception time of the current packet. 

6 (Original) . The method according to claim 5, where the 
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warning is recorded in a read-only medium. 

7 (Previously Presented) . The method according to claim 1, 
further comprising issuing a warning and discarding the current 
packet if the at least part of the source address of the current 
packet_does not match at least part of the at least one source 
address of the previously received packet . 

8 (Original) . The method according to claim 7, where the 
warning is recorded in a read-only medium. 

9 (Previously Presented) . The method according to claim 1, 
where the source address of the current packet is an internet 
protocol (IP) address. 

10 (Cancelled) . 

11 (Currently Amended) . At least one processor readable storage 
Ttiedium for storing a computer program of instructions configured 
to be readable by at least one processor for instructing the at 
least one processor to execute a computer process for performing 
the method as recited in claim 1. 
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12 (Previously Presented) . A system for tracing source 
addresses of packets comprising a first network element for 
receiving a current packet, where the first network element 
comprises : 

a processor module that identifies at least part of a 
source address of the current packet, queries to identify at 
least one source address of a previously received packet, 
determines whether the at least part of the source address of 
the current packet matches at least part of the at least one 
source address of the previously received packet, and routes the 
current packet to a second network element if the at least part 
of the source address of the current packet matches at least 
part of the at least one source address of the previously 
received packet; and 

a storage module that stores the at least one source 
address of the previously received packet , 

13 {Previously Presented) . The system according to claim 12, 
where the at least one source address of the previously received 
packet is recorded in a hierarchical data structure, wherein the 
hierarchical data structure comprises a plurality of classes of 
subnet . 
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14 (Previously Presented) . The system according to claim 12, 
where a Last Time Seen (LTS) value associated with each of the 
at least one source address of the previously received packet is 
recorded. 

15 {Previously Presented) . The system according to claim 12, 
where the processor module is further adapted to record 
reception time of the current packet. 

16 (Previously Presented), The system according to claim 12, 
where the processor module is further adapted to: 

route the current packet to the second network element with 
a warning if the at least part of the source address of the 
current packet does not match at least part of the at least one 
source address of the previously received packet; and 

record the at least part of the source address of the 
current packet and reception time of the current packet. 

17 (Original) . The system according to claim 16, where the 
warning is recorded in a read-only medium. 

18 (Previously Presented) , The system according to claim 12, 
where the processor module is further adapted to issue a warning 
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and discard the current packet if the at least part of the 

source address of the current packet does not match at least 

part of the at least one source address of the previously 

received packet. 

19 (Original) . The system according to claim 18, where the 
warning is recorded in a read-only medium. 

20 {Previously Presented) . The system according to claim 12, 
where the source address of the current packet is an internet 
protocol (IP) address. 

21 (Currently Amended) . A system for tracing source addresses 
of packets, the system comprising: 

means for receiving a current packet at a first network 
element ; 

means for identifying at least part of a source address of 
the current packet; 

means for querying a storage module to identify at least 
one source address of a previously received packet; 

means for determining whether the at least part of the 
source address of the current packet matches at least part of 
the at least one source address of the previously received 
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packet ; and 

means for routing the current packet to a second network 
element if the at least part of the source address of the 
current packet matches at least part of the at least one source 
address of the previously received packet. 

2 2 (Previously Presented) . The method according to claim 1, 
wherein the at least one source address of the previously 
received packet is recorded within a predetermined time period 
prior to receiving the current packet. 

23 (Previously Presented) . The method according to claim 2, 
wherein the plurality of classes of subnet comprises at least 
one of a class A subnet, a class B subnet, and a class C subnet, 
wherein the class A subnet comprises a first octet of the at 
least one source address recorded, the class B subnet comprises 
a second octet of the at least one source address recorded, and 
the class C subnet comprises a third octet of the at least one 
source address recorded. 

24 (Previously Presented). The method according to claim 23, 
wherein determining whether the at least part of the source 
address of the current packet matches at least part of the at 
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least one source address of the previously received packet 

comprises comparing the at least part of the source address of 

the current packet with at least one of the plurality of classes 

of subnet of the at least one source address of the previously 

received packet . 
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